macOS Privileged Account Separation - Creating a New macOS Administrator Account

A good security practice in general (and a requirement of the Cyber Essentials scheme) it is important to ensure that day-to-day work (such as reading/ sending emails, browsing the web, the usual day-to-day stuff!) is only carried out on a standard user account.

Administrator accounts should only be used for administrative purposes (such as installing new software). This is a step by step guide on how to change a local administrator account on an Apple MacOS device into a standard user account.

How To:

1. Go to Apple Menu and then click on 'System Preferences' or 'System Settings' (whichever is available)

2. Click on 'Users & Groups'

3. Click on the padlock icon on the bottom left of the window and enter your password

4. Click on the '+' button

5. On the drop down menu at the top of the window, select 'Administrator'

6. Complete the other details. You can name this account "Admin" to easily recognise it. When choosing a password you should choose one that is at least 12 characters in length in accordance with guidance from the National Cyber Security Centre

It is important that you remember this password as you will need it to install or remove software on your computer. Forgetting this password may result in needing to reset your computer.

Now we have to change your current user account to a standard user account

7. Sign out of the account you are currently on by clicking on the Apple menu and clicking 'Log Out'. Don't forget to save any work first!

8. On the login screen, select the newly created account and log into it.

9. Go to Apple Menu and then click on 'System Preferences' or 'System Settings' (whichever is available)

10. Click on 'Users & Groups'

11. Click on the padlock icon on the bottom left of the window and enter the password for your new "Admin" account

12. Select your usual day-to-day account and untick 'Allow user to administer this computer' or select the blue 'i' icon to the right of the username and then toggle off 'Allow user to administer this computer'

13. Fully restart your Mac computer and when presented with the login screen, select your usual day-to-day working account and log in with your usual password

You now have a separate administrator account for installing software or making configuration changes to your device. You should continue using your usual account for day-to-day working.

Any prompts that you get asking for a password when installing software, you will need to enter the password for your newly created Administrator account.